1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include "telephonyobserver_fuzzer.h"
16 
17 #include <cstddef>
18 #include <cstdint>
19 #include "addstateregistrytoken_fuzzer.h"
20 #define private public
21 #include "securec.h"
22 #include "system_ability_definition.h"
23 #include "telephony_observer.h"
24 #include "telephony_state_registry_service.h"
25 
26 using namespace OHOS::Telephony;
27 namespace OHOS {
28 static bool g_isInited = false;
29 constexpr int32_t BOOL_NUM = 2;
30 constexpr int32_t SLOT_NUM = 2;
31 constexpr int32_t ROAMING_NUM = 4;
32 constexpr int32_t REG_NUM = 6;
33 constexpr int32_t NR_NUM = 7;
34 constexpr int32_t RADIO_NUM = 13;
35 TelephonyObserver telephonyObserver;
36 
IsServiceInited()37 bool IsServiceInited()
38 {
39     if (!g_isInited) {
40         DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnStart();
41         if (DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->GetServiceRunningState() ==
42             static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
43             g_isInited = true;
44         }
45     }
46     return g_isInited;
47 }
48 
OnRemoteRequest(const uint8_t * data,size_t size)49 void OnRemoteRequest(const uint8_t *data, size_t size)
50 {
51     if (!IsServiceInited()) {
52         return;
53     }
54     MessageParcel dataMessageParcel;
55     if (!dataMessageParcel.WriteInterfaceToken(TelephonyObserver::GetDescriptor())) {
56         return;
57     }
58     dataMessageParcel.WriteBuffer(data, size);
59     dataMessageParcel.RewindRead(0);
60     uint32_t code = static_cast<uint32_t>(size);
61     MessageParcel reply;
62     MessageOption option;
63     telephonyObserver.OnRemoteRequest(code, dataMessageParcel, reply, option);
64 }
65 
CallStateUpdatedInner(const uint8_t * data,size_t size)66 void CallStateUpdatedInner(const uint8_t *data, size_t size)
67 {
68     if (!IsServiceInited()) {
69         return;
70     }
71     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
72     int32_t callState = static_cast<int32_t>(size);
73     std::string phoneNumber(reinterpret_cast<const char *>(data), size);
74     MessageParcel dataMessageParcel;
75     dataMessageParcel.WriteInt32(slotId);
76     dataMessageParcel.WriteInt32(callState);
77     dataMessageParcel.WriteString16(Str8ToStr16(phoneNumber));
78     dataMessageParcel.RewindRead(0);
79     MessageParcel reply;
80     telephonyObserver.OnCallStateUpdatedInner(dataMessageParcel, reply);
81 }
82 
SignalInfoUpdatedInner(const uint8_t * data,size_t size)83 void SignalInfoUpdatedInner(const uint8_t *data, size_t size)
84 {
85     if (!IsServiceInited()) {
86         return;
87     }
88     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
89     MessageParcel dataMessageParcel;
90     dataMessageParcel.WriteInt32(slotId);
91     dataMessageParcel.RewindRead(0);
92     MessageParcel reply;
93     telephonyObserver.OnSignalInfoUpdatedInner(dataMessageParcel, reply);
94 }
95 
NetworkStateUpdatedInner(const uint8_t * data,size_t size)96 void NetworkStateUpdatedInner(const uint8_t *data, size_t size)
97 {
98     if (!IsServiceInited()) {
99         return;
100     }
101     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
102     MessageParcel dataMessageParcel;
103     dataMessageParcel.WriteInt32(slotId);
104     auto networkState = std::make_shared<NetworkState>();
105     if (networkState == nullptr) {
106         return;
107     }
108     networkState->isEmergency_ = static_cast<int32_t>(size % BOOL_NUM);
109     std::string mOperatorNumeric(reinterpret_cast<const char *>(data), size);
110     std::string mFullName(reinterpret_cast<const char *>(data), size);
111     std::string mShortName(reinterpret_cast<const char *>(data), size);
112     networkState->psOperatorInfo_.operatorNumeric = mOperatorNumeric;
113     networkState->psOperatorInfo_.fullName = mFullName;
114     networkState->psOperatorInfo_.shortName = mShortName;
115     networkState->csOperatorInfo_.operatorNumeric = mOperatorNumeric;
116     networkState->csOperatorInfo_.fullName = mFullName;
117     networkState->csOperatorInfo_.shortName = mShortName;
118     networkState->csRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
119     networkState->psRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
120     networkState->psRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
121     networkState->csRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
122     networkState->psRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
123     networkState->lastPsRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
124     networkState->lastCfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
125     networkState->csRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
126     networkState->cfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
127     networkState->nrState_ = static_cast<NrState>(size % NR_NUM);
128     networkState->Marshalling(dataMessageParcel);
129     dataMessageParcel.RewindRead(0);
130     MessageParcel reply;
131     telephonyObserver.OnNetworkStateUpdatedInner(dataMessageParcel, reply);
132 }
133 
CellInfoUpdatedInner(const uint8_t * data,size_t size)134 void CellInfoUpdatedInner(const uint8_t *data, size_t size)
135 {
136     if (!IsServiceInited()) {
137         return;
138     }
139     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
140     MessageParcel dataMessageParcel;
141     dataMessageParcel.WriteInt32(slotId);
142     dataMessageParcel.RewindRead(0);
143     MessageParcel reply;
144     telephonyObserver.OnCellInfoUpdatedInner(dataMessageParcel, reply);
145 }
146 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)147 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
148 {
149     if (data == nullptr || size == 0) {
150         return;
151     }
152     OnRemoteRequest(data, size);
153     CallStateUpdatedInner(data, size);
154     SignalInfoUpdatedInner(data, size);
155     NetworkStateUpdatedInner(data, size);
156     CellInfoUpdatedInner(data, size);
157     return;
158 }
159 } // namespace OHOS
160 
161 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)162 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
163 {
164     OHOS::AddStateRegistryTokenFuzzer token;
165     /* Run your code on data */
166     OHOS::DoSomethingInterestingWithMyAPI(data, size);
167     return 0;
168 }
169